Interactive Logon from Same Domain Account to Multiple Devices

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•3

This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.